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Amendments to the Claims: 

This listing of claims will replace all prior versions, and listing, of claims in the 
application: 

Listing of Claims: 

1-20. (previously canceled) 
21-37. (canceled) 

38. (previously presented) A machine-executed method for executing a trusted command 
issued by a user on a computing system including an untrusted computing environment 
and a trusted computing environment, said method comprising the steps of: 

(a) receiving user identification data in the trusted computing environment 
from the user via a trusted path; 

(b) receiving the trusted command from the user in the trusted computing 
environment via an untrusted path; 

(c) parsing the trusted command in the untrusted computing environment to 
generate a parsed command; 

(d) submitting the parsed command to the trusted computing environment; 

(e) performing a security check on the parsed command and user 
identification data in the trusted computing environment; and 

(f) executing the trusted command in the trusted computing environment. 

39. (previously presented) The method of claim 38, wherein the security check enforces 
a security criterion from the Department of Defense Trusted Computer System 
Evaluation Criteria (Ref. No. DOD 5200.28-STD). 
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40. (previously presented) A method including the steps of claim 38 and additionally 
including the steps, executed after step (d) and before step (f) of claim 38, of: 

(1) in the trusted environment, displaying a representation of the parsed 
command to the user; 

(2) receiving a signal from the user signifying whether the displayed 
representation accurately represents the trusted command; and 

(3) if the signal signifies that the displayed representation does not accurately 
represent the trusted command, then preventing the performance of step (f) of claim 38. 

41. (previously presented) A method including the steps of claim 38 and additionally 
including the steps, executed after step (d) and before step (f) of claim 38, of: 

(1) in the trusted environment, displaying a representation of the parsed 
command to a second user; 

(2) receiving a signal from the second user signifying whether the displayed 
representation accurately represents a legitimate command; and 

(3) if the signal signifies that the displayed representation does not accurately 
represent a legitimate command, then preventing the performance of step (f) of claim 38. 
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